Merge remote-tracking branch 'upstream/main' into fix/credo-boundary-type-suppressions

Signed-off-by: cynox-66 <devj2311@gmail.com>

# Conflicts:
#	heka-identity-service/src/common/did-registrar/did-registrar.service.ts
#	heka-identity-service/src/revocation/status-list/status-list.service.ts

Author: cynox-66

.gitignore

@@ -54,3 +54,6 @@ node_modules/
 
 # Intellij IDEs
 .idea
+
+# Auto-generated files
+.yarn/install-state.gz

README.md

@@ -11,27 +11,81 @@ The Heka Identity Platform is intended to speed up adoption of decentralized ide
 
 ## Core Components
 
-The Heka Identity Platform delivers a complete decentralized identity solution composed of two primary applications:
+The platform is composed of the following components:
 
-1.  **Mobile Wallet (Verifiable Credentials Holder)**: A cross-platform mobile application (built with React Native) for end users to receive, store, and present verifiable credentials.
-2.  **Identity Service**: A backend service (built with NestJS) that primarily acts as a Verifiable Credentials Issuer and Verifier, while also supporting Holder capabilities for cloud (custodial) wallet scenarios.
+- **[Heka Wallet](./heka-wallet)** (Verifiable Credentials Holder): Cross-platform mobile application (built with React Native) for end users to receive, store, and present verifiable credentials.
+- **[Identity Service](./heka-identity-service)**: Backend service (built with NestJS) that primarily acts as a Verifiable Credentials Issuer and Verifier, while also supporting Holder capabilities for cloud (custodial) wallet scenarios.
+- **[Identity Service Web UI](./heka-identity-service-web-ui)**: Web UI application for Identity Service — allows managing schemas, credential templates, and issuance / verification flows.
+- **[Auth Service](./heka-auth-service)**: Authentication service used by the Identity Service for tenant and user authentication.
 
 The implementation is based on the **DSR SSI Toolkit** and leverages well-established open-source frameworks: **OWF Credo** and **OWF Bifold**.
 
-## Scope and Supported Standards
+## High-level Architecture
+
+```mermaid
+flowchart LR
+    Wallet[Heka Wallet<br/>Holder]
+    WebUI[Identity Service Web UI<br/>Issuer / Verifier Client]
+    Auth[Auth Service]
+    IS[Identity Service<br/>Issuer / Verifier Wallet]
+    Hedera[(Hiero / Hedera Ledger)]
+
+    WebUI -->|login / register| Auth
+    WebUI -->|REST API + JWT| IS
+    Auth -.->|issues JWTs trusted by| IS
+    Wallet <-->|OID4VC / DIDComm| IS
+    IS -->|DIDs / AnonCreds Resources| Hedera
+    Wallet -->|DIDs and AnonCreds Resources resolution| Hedera
+```
+
+## Getting Started
+
+Each component is set up and run independently. For specific setup and configuration steps, please refer to specific README files in component folders.
+
+The recommended approach for exploring the platform is the following:
+- Set up and get familiar with core functional components - [Identity Service](./heka-identity-service) and [Heka Wallet (Mobile application)](./heka-wallet)
+- Explore the [Identity Service Web UI](./heka-identity-service-web-ui) and [Auth Service](./heka-auth-service) components. These are more general-purpose applications that still represent a crucial piece for complete experience and testing capabilities
+- Once you get familiar with the baseline functionality of a platform, feel free to check out the [demo folder](./demo) to explore various decentralized identity use cases implemented with Heka Identity Platform
+
+## Supported Identity Standards
 
 The platform supports a wide range of global decentralized identity standards, including:
 
-- **Protocols**: OpenID4VC, DIDComm
-- **Credential Formats**: W3C Verifiable Credentials, SD-JWT VC, ISO mDL, Hyperledger AnonCreds
-- **DID Methods**: Multiple DID methods, including Hiero / Hedera-based DIDs
+- **Credential Exchange Protocols**: OpenID for Verifiable Credentials (OID4VC), DIDComm
+- **Credential Formats**: W3C VC-JWT, W3C VC-JWT JSON-LD, W3C VC with Linked Data Proofs, IETF SD-JWT VC, ISO mDoc (mDL), Hyperledger AnonCreds
+- **DID Methods**: `did:key`, `did:peer`, `did:jwk`, `did:web`, `did:indy` (Hyperledger Indy), `did:hedera` (Hiero / Hedera), `did:indybesu` (Indy Besu ledger)
+
+## Agentic AI Integration
+
+Apart from providing support for standard decentralized identity flows, the platform aims to enable use cases that emerge from synergy between identity and Agentic AI.
+This includes (but is not limited to) VC-based trust models for AI agents and the Agentic Economy.
+
+Initial supported use cases:
+
+- **VC-based authorization for agents**: [OID4VP In-Task Authorization Extension for Agent2Agent (A2A) protocol](https://github.com/DSRCorporation/a2a-oid4vp-in-task-auth-extension/blob/main/v1/spec.md)
+
+## Roadmap
+
+See [roadmap](./ROADMAP.md) for the platform's planned scope and timeline — covering core maintenance, emerging protocol support, AI / agentic economy integrations, and other development directions.
 
 ## Demos
 
 Please see the [demo folder](./demo) to explore demos showcasing various decentralized identity use cases implemented with Heka Identity Platform.
 
 - [Agent-to-Agent (A2A) + OID4VP integration](./demo/a2a-oid4vp): A demo showcasing OID4VP-based authentication for AI agents leveraging Agent2Agent (A2A) protocol
 
+Also, feel free to explore Heka-based demos available on YouTube:
+
+- [Agent2Agent interactions with Just-In-Time authorization via OpenID for Verifiable Credentials](https://www.youtube.com/watch?v=3JgFZBGXXXI)
+
+## Hiero Identity Community
+
+For details and references on how to engage with the Hiero Identity community, please see [Hiero Identity Collaboration Hub repo](https://github.com/hiero-ledger/identity-collaboration-hub).
+
+### LFDT mentorship program
+
+Heka Identity Platform is a core component for an upcoming LFDT mentorship project - [Hiero Contributor Identity Verification Prototype](https://mentorship.lfx.linuxfoundation.org/project/64c64daa-ffdb-4871-82f5-01c1bdc7fecc/).
+
 ## Governance
 
 The Heka Identity Platform operates under the governance of the **Hiero Technical Steering Committee (TSC)**, in alignment with existing Hiero project policies.

ROADMAP.md

@@ -0,0 +1,31 @@
+# Heka Identity Platform Roadmap
+
+> **Note** The roadmap reflects the current development plan and is subject to change.
+
+## Scope
+
+- Core maintenance, platform updates and community support
+- Adoption and support for emerging protocols and standards (keeping up with evolving industry)
+- Foundational support for modern AI & agentic economy use cases and protocols (AP2 + x402, ERC-8004, etc.)
+- Continued prototyping and integration of identity solutions in Hiero ecosystem (Contributor Identity Verification mentorship program, Hiero-specific identity features and cross-project integrations)
+- Support for enterprise adoption and use cases
+- Advanced ZKP support (Longfellow ZKP, etc.)
+
+## Timeline
+
+```mermaid
+timeline
+    Q2 2026 : Platform and dependencies updates
+            : Documentation improvements
+            : Heka Identity Platform LFDT workshop
+            : Hiero Contributor Identity Verification Prototype — LFDT mentorship kick-off
+            : Digital Credentials API (DC API) support
+    Q3 2026 : ERC-8004
+            : AP2 credentials
+            : SSO via SSI support + WebUI demo
+            : HBAR wallet integration for Heka Wallet
+    Q4 2026 and beyond : Hiero Contributor Identity Verification Prototype — LFDT mentorship completion, verification flow integration and improvements
+                       : Support for Longfellow ZK in Heka Wallet and Identity Service (mDL)
+                       : "First-class citizen" support for issuance in Heka Wallet
+                       : DeRec protocol support for Heka Wallet (backup and recovery)
+```

demo/a2a-oid4vp/README.md

@@ -16,7 +16,7 @@ The agent is configured to require the user to present a verifiable credential v
 The following mapping applies for roles/parties described in [OID4VP In-Task Authentication extension spec](https://github.com/DSRCorporation/a2a-oid4vp-in-task-auth-extension/blob/main/v1/spec.md):
 - A2A Client → [CLI client](src/cli.ts)
 - A2A Server → [Demo Agent Server](src/agent/index.ts)
-- OID4VP Wallet → [Heka Mobile Wallet](../../heka-wallet)
+- OID4VP Wallet → [Heka Wallet](../../heka-wallet)
 - OID4VP Verifier → [Heka Identity Service](../../heka-identity-service)
 
 **High-level demo flow:**
@@ -34,7 +34,7 @@ sequenceDiagram
     Agent->>HIS: (2.1) Create Verification Session (OID4VP)
     HIS-->>Agent: (2.2) Authorization Request Metadata
     Agent->>CLI: (2.3) Status Update (state: auth-required + metadata)
-    CLI->>Wallet: (3) Invoke Wallet (Out-of-band / DidComm)
+    CLI->>Wallet: (3) Invoke Wallet (Out-of-band / DIDComm)
     Wallet->>User: (4.1) Display Authorization Request
     User->>Wallet: (4.2) Confirm Presentation
     Wallet->>HIS: (4.3) Submit Verifiable Presentation (OID4VP direct_post)
@@ -81,7 +81,7 @@ However, there are values that need to be manually set up:
 
 Other supported values:
 - `DEMO_AGENT_PORT` - Port to be used by the Demo Agent server, defaults to `10003`
-- `CLI_CLIENT_PORT` - Port to be used by CLI Client inbound transport (DidComm inbound transport, used for Mobile Wallet invocation), defaults to `3010`
+- `CLI_CLIENT_PORT` - Port to be used by CLI Client inbound transport (DIDComm inbound transport, used for Heka Wallet invocation), defaults to `3010`
 - `IDENTITY_SERVICE_URL` - URL of local instance of Heka Identity Service, defaults to `http://localhost:3000`. Must be changed if host, port, or API prefix configuration of the instance differs from default values
 - `IDENTITY_SERVICE_ACCESS_TOKEN` - Heka Identity Service API token, default value is a demo token with extremely long validity period. Must be changed if JWT configuration for Heka Identity Service instance was changed
 
@@ -168,7 +168,7 @@ In a second terminal, start the CLI Client:
 yarn client
 ```
 
-The CLI Client will start an inbound DidComm transport that will use port 3010 (can be changed using `CLI_CLIENT_PORT` env variable).
+The CLI Client will start an inbound DIDComm transport that will use port 3010 (can be changed using `CLI_CLIENT_PORT` env variable).
 
 ### 7. Try out integration with the Agent
 
@@ -181,7 +181,7 @@ mechanics of leveraging Heka Identity Platform for Agent-to-Agent (A2A) protocol
 it is critical to treat any agent operating outside of your direct control as a
 potentially untrusted entity.
 
-The demonstrated flow involves usage of OID4VP Response Mode `direct_post` that is vulnerable to Session Fixation attacks ([Ref](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#name-session-fixation)). Production deployments must provide an additonal security mechanism to prevent such attacks.
+The demonstrated flow involves usage of OID4VP Response Mode `direct_post` that is vulnerable to Session Fixation attacks ([Ref](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#name-session-fixation)). Production deployments must provide an additional security mechanism to prevent such attacks.
 
 All data received from an external agent—including but not limited to its AgentCard,
 messages, artifacts, and task statuses—should be handled as untrusted input. For

heka-auth-service/Dockerfile

@@ -8,7 +8,6 @@ COPY package*.json yarn.lock ./
 
 RUN yarn install
 COPY . .
-RUN yarn test
 RUN yarn build
 
 FROM node:18-bookworm-slim